我对curl完全陌生,正在尝试确定网站是否使用严格传输安全。
我正在放弃建议。我被告知要检查 Chrome 的预加载列表 并运行
curl -D - https://www.example.com | head -n 20
检查严格传输安全标头。
但是“head”命令生成了错误且未知。
有什么想法吗?
ATM 我正在运行 Win XP,几天后将有一个 Linux 发行版。
谢谢。
这个方法不错。
$ curl -s -D- https://paypal.com/ | grep Strict
Strict-Transport-Security: max-age=14400
正如您所注意到的,一些网络服务器只是拒绝接受
HEAD
请求。 curl
将使用 GET
:打印
-v
请求的标头
$ curl -s -vv https://paypal.com/ 2>&1 | grep Strict
< Strict-Transport-Security: max-age=14400
<
表示标头是服务器返回给您的标头。
实际的
example.com
,如您的示例所示,将不起作用,因为它根本不监听 https://
:
$ curl -D- https://www.example.com
curl: (7) couldn't connect to host
由于
Strict-Transport-Security
标头仅在通过 https://
传递时才被尊重,因此可以非常安全地假设任何在 https://
上不响应的网站都没有使用 STS,特别是因为它没有任何理由这样做。
Chrome 有 HSTS 检查功能
chrome://net-internals#hsts
但请注意,每当您通过 https 请求网站时,Chrome 也喜欢添加条目。
刚刚让 chrome 将我重定向到 https,访问尚未获得 https 证书的内部网站。甚至没有听 443。毫不奇怪,curl 没有返回 Strict 标头。然后我发现 chrome 有一个内部 HSTS 列表。可以从 chrome://net-internals#hsts 清除,不包括 Google 维护的全球列表。
[扩展@FauxFaux的答案]
我想看看我的网站与业内其他网站相比如何。所以,我写了一个 bash
for
循环。我发现有些网站不仅不会以与 HEAD
不同的方式对待 GET
请求,而且它们(亚马逊和微软)对待 curl
的方式也与真正的浏览器不同。因此,我在请求中添加了一些标头以获得真实的响应。
# NOTE: You can copy/paste this whole block straight into a bash shell
apex_domains=(
paypal.com
amazon.com
google.com
microsoft.com
)
curl_command=`
`"curl -svo /dev/null "`
`"-H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) "`
`"AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' "`
`"-H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif"`
`",image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' "`
`"-H 'accept-language: en-US,en;q=0.9' "`
`"--compressed"
for domain in "${apex_domains[@]}"; do
for scheme in 'http' 'https'; do
for subdomain in '' 'www.'; do
echo -e "\n"" ${scheme}://${subdomain}${domain}"
echo " $curl_command ${scheme}://${subdomain}${domain}"
eval "$curl_command ${scheme}://${subdomain}${domain}" 2>&1 | \
tr -d '\r' | grep -i --color=always 'strict-transport-security.*';
done
done
done
输出在终端上看起来更好,因为 grep 标题被突出显示。
http://paypal.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://paypal.com
http://www.paypal.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://www.paypal.com
https://paypal.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://paypal.com
< strict-transport-security: max-age=31536000; includeSubDomains
https://www.paypal.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://www.paypal.com
< strict-transport-security: max-age=63072000; includeSubDomains; preload
http://amazon.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://amazon.com
http://www.amazon.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://www.amazon.com
https://amazon.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://amazon.com
https://www.amazon.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://www.amazon.com
< strict-transport-security: max-age=47474747; includeSubDomains; preload
http://google.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://google.com
http://www.google.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://www.google.com
https://google.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://google.com
https://www.google.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://www.google.com
< strict-transport-security: max-age=31536000
http://microsoft.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://microsoft.com
http://www.microsoft.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed http://www.microsoft.com
https://microsoft.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://microsoft.com
https://www.microsoft.com
curl -svo /dev/null -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' -H 'accept-language: en-US,en;q=0.9' --compressed https://www.microsoft.com
< strict-transport-security: max-age=31536000
虽然这些答案是有效的,但我发现仅使用
-I
中的 --head
或 curl
开关来仅显示文档 HEAD 信息要简单得多。运行 -I
可以节省您对整个下载页面进行 grep 的时间。例如
$ curl -I https://paypal.com
...
strict-transport-security: max-age=300
...